Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pastejacking

github.com

Post reply on HN
Print view View original

101–110 of 246 posts

Re: Pastejacking

#101

Post by rcthompson »

userbinator wrote: post #23
landhar wrote: post #13

Why do browsers not require explicit user permission before allowing a site to perform clipboard manipulations? In a similar tashion to how the HTML5 geo-location API is opt-in?

Firefox and IE let this feature be configurable: https://msdn.microsoft.com/en-us/library/bb250473(v=vs.85).a... http://i.stack.imgur.com/jvDUh.png https://developer.mozilla.org/en-US/docs/Mozilla/Preferences... But the same quick search shows that it does not appear possible to control this in Chrome. If anyone knows how, please correct me.

I just turned this preference off in Firefox, and it didn't stop the demo from working, which makes sense since the preference says it only disables oncopy/cut/paste events, and this demo uses a different method.

Re: Pastejacking

#102

Post by dzhiurgis »

jschwartzi wrote: post #98
logicallee wrote: post #91

Earlier quoted context omitted.

The proof of concept didn't work for me. I highlighted the text, right-clicked and clicked "copy". I thought it was just broken or not hooking the on-copy properly. Then I realized that the reason I was doing that instead of ctrl-c is all the times that web sites break ctrl-c. I literally have gotten used to highlighting, right-clicking, and clicking copy, for a "clean" copy :) I wasn't even aware I was doing this. O…

Right-click hooking could be defeated by inserting a sequence number in the right-click menu and displaying the same sequence number somewhere in the browser window. I will say that the people who generate event hooks in browsers need to pull their heads out of their asses before this kind of thing becomes necessary.

Highlight, then Edit -> Copy.

But then, I've seen sites that break highlighting. Either intentionally, or accidentally, thinking people will share their every highlight on Twitter (I am looking at you, Medium).

Re: Pastejacking

#104

Post by capitalsigma »

losteric wrote: post #86
conradev wrote: post #83

Earlier quoted context omitted.

Or to block the loading of the offending javascript!

What's stopping websites from minifying all their javascript into one file and preventing the site from functioning without JS?

Then refuse to use them. That's what I do.

Re: Pastejacking

#105

Post by lgas »

kevincox wrote: post #85

zsh actually detects pastes into the terminal and doesn't submit the commands on newlines. This way you see the full command and have to hit enter yourself to run it. It isn't perfect because people could try to obscure the command but in general it makes me a lot happier to paste commands into my terminal.

This was one of the first things that made me fall in love with zsh.

Re: Pastejacking

#106

Post by RKearney »

busterarm wrote: post #81
hoodoof wrote: post #8

So I copy a command off a dodgy website, hit paste in my terminal, and a command drops which runs a shell script that downloads a rootkit, logs me out and clears the screen leaving me thinking that some weird glitch has happened but all it OK - is that the sort of scenario we are talking?

Or just has a fun little `rm -rf /`

http://linux.die.net/man/1/rm

    --preserve-root
        do not remove '/' (default)

Re: Pastejacking

#107

Post by Mandatum »

Mahn wrote: post #84

For the record you don't actually need to depend on new APIs like "document.execCommand('copy')", simply shifting focus to an off-screen textbox area when ctrl is down will do the trick in 95% of the cases, with full cross browser compatibility.

.. Not sure this would work in OSX.

Re: Pastejacking

#108

Post by ashitlerferad »

woodman wrote: post #79
sethammons wrote: post #56

Earlier quoted context omitted.

What do you mean by it worked? Did you have metrics supporting increased views that were tied to the paste highjacking?

Demand Media makes money by monitoring ad networks and then paying people to churn out worthless content that pollutes search results. They watch metrics very carefully.

Sounds like a pretty unethical way to make money.

Re: Pastejacking

#109

Post by nathancahill »

rbut wrote: post #7

This is why I always copy a command into TextEdit (or Notepad on Windows) first, and then re-copy the clean text before pasting into my terminal. While we are on the topic of copying and pasting. If the command downloads a script, make sure you download the script out-of-step via curl first, review its contents, and only then execute it. This avoids sites maliciously changing the script based on the User Agent.

I use Quicksilver, and generally paste what I've copied there first. Also lets me strip the formatting, like pasting with Shift + Option + Command + V.

Re: Pastejacking

#110

Post by nathancahill »

zbuttram wrote: post #2

The author noted that iTerm on MacOS notifies when a paste that's about to happen contains a newline. Cmder on Windows does this as well, it's a nice feature even outside of the security concerns.

Didn't get a confirmation on iTerm 2.1.4, Firefox 46.0.1, OSX 10.11 (latest stable everything). Not sure if I missed something.
Post reply on HN